In mobile communications, e.g. according to the GSM or UMTS standard, security is of utmost importance. This is very much related to the increased use of mobile communications in business relations and for private communication. It is now known that for example GSM suffers from security problems. As recently described in reference [1], it is possible to retrieve the encryption key by breaking the A5/2 cryptographic algorithm. There are three basic algorithm choices for circuit switched data, A5/1, A5/2, A5/3 and three basic algorithms for packet data, GEA1, GEA2 and GEA3. It should however be noted that there are also stronger 128-bit algorithms denoted A5/4 and GEA4. The terminal signals its capabilities, in particular the set of crypto algorithms it supports, to the network. The network then selects which crypto algorithm to use. Note that this signaling is unprotected. Thus the terminal has no chance to detect if and when an attacker is signaling that it should use A5/2 and that this information originates from a legitimate operator.
Generally, there are at least three types of attacks. The first type involves an attacker that intercepts and decrypts traffic when the system is using the broken A5/2 algorithm.
The second type of attack comprises interception of traffic associated with the AKA procedure to record traffic data and the RAND value that is used. Later, a false base station can make the mobile terminal execute an AKA procedure using the previously recorded RAND and then encrypt the traffic using the A5/2 algorithm, which enables the attacker to retrieve the crypto key Kc. Due to the simple dependence on RAND this key, Kc, will be the same key as was used to protect the recorded traffic.
The third type of attack involves an active man-in-the-middle forcing the terminal to use the A5/2 algorithm, thereby enabling calculation of the crypto key.
The UMTS standard advises methods that overcome most of these problems. However, a scenario is foreseen in which GSM terminals will be used during a considerable period of time until UMTS terminals have become property of the great majority of users. In fact, many advanced services will be available on GSM phones and users may be reluctant to exchange their phones until at a later time.
In addition, while UMTS has countermeasures that make it resistant to these attacks, there is of course a worry that future advances in crypto-analysis discover that similar problems exist also there and/or in other communication systems. Moreover, there could be security problems involved when roaming between different types of networks, such as GSM and UMTS networks.